Horizon Alert
Summary of the vulnerability and why it matters
A vulnerability has been identified in the vm2 sandboxing library used in Node.js environments. This issue could allow for the escape of the sandbox, potentially leading to unauthorized code execution. The primary concern is to confirm if this technology is in use and exposed to untrusted input.
- Code can escape sandbox protections.
- Affects applications using vm2 for sandboxing.
- Confirm relevance and exposure of the library.
Attack Path
How an attacker could exploit the issue
An attacker could leverage a sandbox escape in the vm2 library to execute arbitrary code on a Node.js system. This is achieved by exploiting a flaw in how `Promise.prototype.finally()` interacts with V8's PromiseThenLookupChain protector, allowing the attacker to bypass sandbox restrictions and gain access to host functions.
- No authentication required for entry.
- Triggered by crafting a specific asynchronous function.
- Risk of arbitrary code execution on the host.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could allow attackers to escape the sandbox environment in Node.js applications that use the vm2 library. When processing untrusted code, certain asynchronous operations might bypass security protections, enabling arbitrary code execution on the host system.
- Host system code execution.
- Exploits asynchronous function with controlled constructor.
- Compromise of the Node.js application.
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams responsible for Node.js applications and their underlying infrastructure should address this critical vulnerability. The first practical step is to identify all deployments of the affected library, confirm if they process untrusted input or are exposed externally, and then assign ownership for remediation.
- Confirm application owner and scope.
- Verify external reachability and business impact.
- Plan remediation based on risk assessment.
